X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=test%2Frecipes%2F70-test_tls13messages.t;h=0d25beffa9c73c837c98b3149c646d06963d2656;hp=ac61c77d0e6acacac60cc654f526c33e453634fb;hb=d734582275aa29ef839af2130ae84af20b84425e;hpb=a1448c26d2bbec390db4c00bf3867c4369af7d15 diff --git a/test/recipes/70-test_tls13messages.t b/test/recipes/70-test_tls13messages.t old mode 100755 new mode 100644 index ac61c77d0e..0d25beffa9 --- a/test/recipes/70-test_tls13messages.t +++ b/test/recipes/70-test_tls13messages.t @@ -11,18 +11,10 @@ use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file srctop_dir bldtop_dir/; use OpenSSL::Test::Utils; use File::Temp qw(tempfile); use TLSProxy::Proxy; +use checkhandshake qw(checkhandshake @handmessages @extensions); -my $test_name; - -# This block needs to run before 'use lib srctop_dir' directives. -BEGIN { - $test_name = "test_tls13messages"; - OpenSSL::Test::setup($test_name); -} - -use lib srctop_dir("test", "recipes"); - -use recipes::checkhandshake qw(checkhandshake @handmessages @extensions); +my $test_name = "test_tls13messages"; +setup($test_name); plan skip_all => "TLSProxy isn't usable on $^O" if $^O =~ /^(VMS|MSWin32)$/; @@ -42,63 +34,99 @@ $ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf"); @handmessages = ( [TLSProxy::Message::MT_CLIENT_HELLO, - recipes::checkhandshake::ALL_HANDSHAKES], + checkhandshake::ALL_HANDSHAKES], + [TLSProxy::Message::MT_HELLO_RETRY_REQUEST, + checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE], + [TLSProxy::Message::MT_CLIENT_HELLO, + checkhandshake::HRR_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE], [TLSProxy::Message::MT_SERVER_HELLO, - recipes::checkhandshake::ALL_HANDSHAKES], + checkhandshake::ALL_HANDSHAKES], [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, - recipes::checkhandshake::ALL_HANDSHAKES], + checkhandshake::ALL_HANDSHAKES], [TLSProxy::Message::MT_CERTIFICATE_REQUEST, - recipes::checkhandshake::CLIENT_AUTH_HANDSHAKE], + checkhandshake::CLIENT_AUTH_HANDSHAKE], [TLSProxy::Message::MT_CERTIFICATE, - recipes::checkhandshake::ALL_HANDSHAKES & ~recipes::checkhandshake::RESUME_HANDSHAKE], - [TLSProxy::Message::MT_CERTIFICATE_STATUS, - recipes::checkhandshake::OCSP_HANDSHAKE], + checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)], + [TLSProxy::Message::MT_CERTIFICATE_VERIFY, + checkhandshake::ALL_HANDSHAKES & ~(checkhandshake::RESUME_HANDSHAKE | checkhandshake::HRR_RESUME_HANDSHAKE)], [TLSProxy::Message::MT_FINISHED, - recipes::checkhandshake::ALL_HANDSHAKES], + checkhandshake::ALL_HANDSHAKES], [TLSProxy::Message::MT_CERTIFICATE, - recipes::checkhandshake::CLIENT_AUTH_HANDSHAKE], + checkhandshake::CLIENT_AUTH_HANDSHAKE], [TLSProxy::Message::MT_CERTIFICATE_VERIFY, - recipes::checkhandshake::CLIENT_AUTH_HANDSHAKE], + checkhandshake::CLIENT_AUTH_HANDSHAKE], [TLSProxy::Message::MT_FINISHED, - recipes::checkhandshake::ALL_HANDSHAKES], + checkhandshake::ALL_HANDSHAKES], [0, 0] ); @extensions = ( [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME, - recipes::checkhandshake::SERVER_NAME_CLI_EXTENSION], + checkhandshake::SERVER_NAME_CLI_EXTENSION], [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST, - recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION], + checkhandshake::STATUS_REQUEST_CLI_EXTENSION], [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS, - recipes::checkhandshake::DEFAULT_EXTENSIONS], + checkhandshake::DEFAULT_EXTENSIONS], [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS, - recipes::checkhandshake::DEFAULT_EXTENSIONS], + checkhandshake::DEFAULT_EXTENSIONS], [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS, - recipes::checkhandshake::DEFAULT_EXTENSIONS], + checkhandshake::DEFAULT_EXTENSIONS], [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN, - recipes::checkhandshake::ALPN_CLI_EXTENSION], + checkhandshake::ALPN_CLI_EXTENSION], [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT, - recipes::checkhandshake::SCT_CLI_EXTENSION], + checkhandshake::SCT_CLI_EXTENSION], [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ENCRYPT_THEN_MAC, - recipes::checkhandshake::DEFAULT_EXTENSIONS], + checkhandshake::DEFAULT_EXTENSIONS], [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EXTENDED_MASTER_SECRET, - recipes::checkhandshake::DEFAULT_EXTENSIONS], + checkhandshake::DEFAULT_EXTENSIONS], [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SESSION_TICKET, - recipes::checkhandshake::DEFAULT_EXTENSIONS], + checkhandshake::DEFAULT_EXTENSIONS], [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE, - recipes::checkhandshake::DEFAULT_EXTENSIONS], + checkhandshake::DEFAULT_EXTENSIONS], [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS, - recipes::checkhandshake::DEFAULT_EXTENSIONS], + checkhandshake::DEFAULT_EXTENSIONS], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES, + checkhandshake::DEFAULT_EXTENSIONS], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK, + checkhandshake::PSK_CLI_EXTENSION], + + [TLSProxy::Message::MT_HELLO_RETRY_REQUEST, TLSProxy::Message::EXT_KEY_SHARE, + checkhandshake::KEY_SHARE_HRR_EXTENSION], + + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SERVER_NAME, + checkhandshake::SERVER_NAME_CLI_EXTENSION], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST, + checkhandshake::STATUS_REQUEST_CLI_EXTENSION], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS, + checkhandshake::DEFAULT_EXTENSIONS], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS, + checkhandshake::DEFAULT_EXTENSIONS], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN, + checkhandshake::ALPN_CLI_EXTENSION], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT, + checkhandshake::SCT_CLI_EXTENSION], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_KEY_SHARE, + checkhandshake::DEFAULT_EXTENSIONS], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_VERSIONS, + checkhandshake::DEFAULT_EXTENSIONS], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK_KEX_MODES, + checkhandshake::DEFAULT_EXTENSIONS], + [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_PSK, + checkhandshake::PSK_CLI_EXTENSION], [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_KEY_SHARE, - recipes::checkhandshake::DEFAULT_EXTENSIONS], + checkhandshake::DEFAULT_EXTENSIONS], + [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_PSK, + checkhandshake::PSK_SRV_EXTENSION], [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_SERVER_NAME, - recipes::checkhandshake::SERVER_NAME_SRV_EXTENSION], - [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_STATUS_REQUEST, - recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION], + checkhandshake::SERVER_NAME_SRV_EXTENSION], [TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS, TLSProxy::Message::EXT_ALPN, - recipes::checkhandshake::ALPN_SRV_EXTENSION], + checkhandshake::ALPN_SRV_EXTENSION], + + [TLSProxy::Message::MT_CERTIFICATE, TLSProxy::Message::EXT_STATUS_REQUEST, + checkhandshake::STATUS_REQUEST_SRV_EXTENSION], + [0,0,0] ); @@ -111,39 +139,42 @@ my $proxy = TLSProxy::Proxy->new( #Test 1: Check we get all the right messages for a default handshake (undef, my $session) = tempfile(); -#$proxy->serverconnects(2); +$proxy->serverconnects(2); $proxy->clientflags("-sess_out ".$session); +$proxy->sessionfile($session); $proxy->start() or plan skip_all => "Unable to start up Proxy for tests"; -plan tests => 12; -checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, - recipes::checkhandshake::DEFAULT_EXTENSIONS, +plan tests => 15; +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS, "Default handshake test"); -#TODO(TLS1.3): Test temporarily disabled until we implement TLS1.3 resumption #Test 2: Resumption handshake -#$proxy->clearClient(); -#$proxy->clientflags("-sess_in ".$session); -#$proxy->clientstart(); -#checkmessages(RESUME_HANDSHAKE, "Resumption handshake test"); -unlink $session; +$proxy->clearClient(); +$proxy->clientflags("-sess_in ".$session); +$proxy->clientstart(); +checkhandshake($proxy, checkhandshake::RESUME_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::PSK_CLI_EXTENSION + | checkhandshake::PSK_SRV_EXTENSION, + "Resumption handshake test"); #Test 3: A status_request handshake (client request only) $proxy->clear(); $proxy->clientflags("-status"); $proxy->start(); -checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, - recipes::checkhandshake::DEFAULT_EXTENSIONS - | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION, - "status_request handshake test (client)"); +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::STATUS_REQUEST_CLI_EXTENSION, + "status_request handshake test (client)"); #Test 4: A status_request handshake (server support only) $proxy->clear(); $proxy->serverflags("-status_file " .srctop_file("test", "recipes", "ocsp-response.der")); $proxy->start(); -checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, - recipes::checkhandshake::DEFAULT_EXTENSIONS, - "status_request handshake test (server)"); +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS, + "status_request handshake test (server)"); #Test 5: A status_request handshake (client and server) #TODO(TLS1.3): TLS1.3 doesn't actually have CertificateStatus messages. This is @@ -154,76 +185,76 @@ $proxy->clientflags("-status"); $proxy->serverflags("-status_file " .srctop_file("test", "recipes", "ocsp-response.der")); $proxy->start(); -checkhandshake($proxy, recipes::checkhandshake::OCSP_HANDSHAKE, - recipes::checkhandshake::DEFAULT_EXTENSIONS - | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION - | recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION, - "status_request handshake test"); +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::STATUS_REQUEST_CLI_EXTENSION + | checkhandshake::STATUS_REQUEST_SRV_EXTENSION, + "status_request handshake test"); #Test 6: A client auth handshake $proxy->clear(); $proxy->clientflags("-cert ".srctop_file("apps", "server.pem")); $proxy->serverflags("-Verify 5"); $proxy->start(); -checkhandshake($proxy, recipes::checkhandshake::CLIENT_AUTH_HANDSHAKE, - recipes::checkhandshake::DEFAULT_EXTENSIONS, - "Client auth handshake test"); +checkhandshake($proxy, checkhandshake::CLIENT_AUTH_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS, + "Client auth handshake test"); #Test 7: Server name handshake (client request only) $proxy->clear(); $proxy->clientflags("-servername testhost"); $proxy->start(); -checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, - recipes::checkhandshake::DEFAULT_EXTENSIONS - | recipes::checkhandshake::SERVER_NAME_CLI_EXTENSION, - "Server name handshake test (client)"); +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::SERVER_NAME_CLI_EXTENSION, + "Server name handshake test (client)"); #Test 8: Server name handshake (server support only) $proxy->clear(); $proxy->serverflags("-servername testhost"); $proxy->start(); -checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, - recipes::checkhandshake::DEFAULT_EXTENSIONS, - "Server name handshake test (server)"); +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS, + "Server name handshake test (server)"); #Test 9: Server name handshake (client and server) $proxy->clear(); $proxy->clientflags("-servername testhost"); $proxy->serverflags("-servername testhost"); $proxy->start(); -checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, - recipes::checkhandshake::DEFAULT_EXTENSIONS - | recipes::checkhandshake::SERVER_NAME_CLI_EXTENSION - | recipes::checkhandshake::SERVER_NAME_SRV_EXTENSION, - "Server name handshake test"); +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::SERVER_NAME_CLI_EXTENSION + | checkhandshake::SERVER_NAME_SRV_EXTENSION, + "Server name handshake test"); #Test 10: ALPN handshake (client request only) $proxy->clear(); $proxy->clientflags("-alpn test"); $proxy->start(); -checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, - recipes::checkhandshake::DEFAULT_EXTENSIONS - | recipes::checkhandshake::ALPN_CLI_EXTENSION, - "ALPN handshake test (client)"); +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::ALPN_CLI_EXTENSION, + "ALPN handshake test (client)"); #Test 11: ALPN handshake (server support only) $proxy->clear(); $proxy->serverflags("-alpn test"); $proxy->start(); -checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, - recipes::checkhandshake::DEFAULT_EXTENSIONS, - "ALPN handshake test (server)"); +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS, + "ALPN handshake test (server)"); #Test 12: ALPN handshake (client and server) $proxy->clear(); $proxy->clientflags("-alpn test"); $proxy->serverflags("-alpn test"); $proxy->start(); -checkhandshake($proxy, recipes::checkhandshake::DEFAULT_HANDSHAKE, - recipes::checkhandshake::DEFAULT_EXTENSIONS - | recipes::checkhandshake::ALPN_CLI_EXTENSION - | recipes::checkhandshake::ALPN_SRV_EXTENSION, - "ALPN handshake test"); +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::ALPN_CLI_EXTENSION + | checkhandshake::ALPN_SRV_EXTENSION, + "ALPN handshake test"); #Test 13: SCT handshake (client request only) #TODO(TLS1.3): This only checks that the client side extension appears. The @@ -238,9 +269,31 @@ $proxy->clientflags("-ct"); $proxy->serverflags("-status_file " .srctop_file("test", "recipes", "ocsp-response.der")); $proxy->start(); -checkhandshake($proxy, recipes::checkhandshake::OCSP_HANDSHAKE, - recipes::checkhandshake::DEFAULT_EXTENSIONS - | recipes::checkhandshake::SCT_CLI_EXTENSION - | recipes::checkhandshake::STATUS_REQUEST_CLI_EXTENSION - | recipes::checkhandshake::STATUS_REQUEST_SRV_EXTENSION, - "SCT handshake test"); +checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::SCT_CLI_EXTENSION + | checkhandshake::STATUS_REQUEST_CLI_EXTENSION + | checkhandshake::STATUS_REQUEST_SRV_EXTENSION, + "SCT handshake test"); + +#Test 14: HRR Handshake +$proxy->clear(); +$proxy->serverflags("-curves P-256"); +$proxy->start(); +checkhandshake($proxy, checkhandshake::HRR_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::KEY_SHARE_HRR_EXTENSION, + "HRR handshake test"); + +#Test 15: Resumption handshake with HRR +$proxy->clear(); +$proxy->clientflags("-sess_in ".$session); +$proxy->serverflags("-curves P-256"); +$proxy->start(); +checkhandshake($proxy, checkhandshake::HRR_RESUME_HANDSHAKE, + checkhandshake::DEFAULT_EXTENSIONS + | checkhandshake::KEY_SHARE_HRR_EXTENSION + | checkhandshake::PSK_CLI_EXTENSION + | checkhandshake::PSK_SRV_EXTENSION, + "Resumption handshake with HRR test"); +unlink $session;